FFmpeg versions 0.10 through 9.0.2 contain a use‑of‑uninitialized memory bug in the Sun Raster decoder that allows an attacker to craft a truncated 1‑bit or 4‑bit paletted image file. When the decoder expands the temporary bitmap into 8‑bit pixels, it leaks stale heap data such as allocator words into the output, exposing sensitive confidentiality information. The bug is a straightforward memory‑disclosure flaw based on improper initialization of a buffer.

All FFmpeg distributions between 0.10 and 9.0.2, including all full releases, are impacted. Any application or service that incorporates a pre‑9.0.3 build of FFmpeg and processes Sun Raster files can be affected.

The CVSS score of 6.8 indicates a moderate severity. The vulnerability requires the attacker to supply a specially crafted Sun Raster file, so the attack vector is most likely exploitation of a decoder routine in a locally or remotely accessed image processing application; specific conditions (such as exposure to untrusted files) are necessary. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploit activity yet. Nevertheless, the moderate CVSS and potential for confidential data leakage warrant timely remediation.